dibujitos

the root and the_internet vdoms are configured in nat mode the dmz and local vdoms are configured in tranparent mode. the root vdom is the management vdom the to_internet vdom allows lan users to access the internet.the to_internet vdom is the only vdom with internet access and is directly connected to ISP modem. which statement is true?

• inter-vdom links are not requiered between the root and to_internet vdoms and to_internet vdoms because the root vdoms is used only as a management vdom

• inter-vdom links are required to allow traffic between the local and dmz vdoms

• inter-vdom links are required to allow traffic between the local and root vdoms

• a static route is required on the to_internet vdom to allow lan users to access the internet

review the intrusion prevention system(ips) profile signature settings. which statement is correct in adding the ftp.login.failed signature to the ips sensor profile?3

• traffic matching the signature will be allowed and logged

• traffic matching the signature will be silently dropped and logged

• the signature setting uses a custom rating threshold,

• the signature setting includes a group of other signatures

refer to the exhibit to view the firewall policy. which statement is correct it if well-known viruses are not being blocked?5

• the firewall policy does not apply deep content inspection

• the action on the firewall policy must be set to deny

• web filter should be enable on the firewall policy to complement the antivirus profile

• the firewall policy must be configured in proxy-based inspection mode

the exhibit contains a network diagram, central snat policy, and IP pool configuration. the WAN(port1) interfaces has the ip address 10.200.1.1/24. the lan(port3) interfaces has the IP address 10.0.1.254/24. a firewall policy is configured to allow all destination from................7

• 10.200.1.99

• 10.200.1.49

• 10.200.1.149

• 10.200.1.1

based on the raw log, which two statements are correct? choose two.8

• traffic is blocked because action is set to DENY in the firewall policy

• log severity is set to error on fortigate

• traffic belongs to the root VDOM

• this is a security log

based on the administrator profile settings what permissions must the administrator set to run the diagnose firewall auth list CLI command on foritgate?

• read/write permission for log & report

• read/write permission for firewall

• custom premission for network

• CLI diagnostics commands permission

the exhibit contains a network diagram, firewall policies, and a firewall address object configuration. an administrator created a deny policy with default settings to deny webserver access for remote user2 remote-user2 is still able to access webserver. which two changes can the administrator make to deny webserver access for remote-user2?choose two.10

• disable match-vip in the Deny policy

• enable match-vip in the deny policy

• set the destination address as web server in the deny policy

• set the destination address as deny. ip in the allow-access policy

refer to the exhibit, which contains a static route configuration. an administrator created a static route for amazon web services. what CLI command must the administrator use to view the route?11

• diagnose firewall proute list

• get router info routing-table database

• get internet-service route list

• get router info routing-table all

in the network shown in the exhibit, the client cannot connect to the HTTP web server. the administrator runs the fortigate built-in sniffer and gets the output as shown in the exhibit. what should the administrator do next to troublesshot the problem? 12

• execute a debug flow

• execute another sniffer in the fortigate, this time with the filter "host 10.0.1.10"

• run a sniffer on the web server

• capture the traffic using an external sniffer connected to port1

why did fortigate drop the packet?19

• it failed the RPF check

• the next-hop IP address is unreachable

• it matched the default implicit firewall policy

• it matched an explicitly configured firewall policy with the action DENY